mystic | b0707ded6960936877cf4a2a4a5a7191894ea5c19ee70296e7004b5431f5044e

Analysis

max time kernel
135s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838.exe
Size

761KB
MD5

b2dcabdfbf8b456e5d150752dcba2f53
SHA1

debe493dcb0e8abf0d6a4ede1ba178e5b0d8480f
SHA256

b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838
SHA512

cedb134c0df27cd1a8e3736aa7f69fd9ea4241e250d87e7d8c978fa0e0c73d7c2e88cd021532bfdae6337b14d007331d6eaac3bdf18b0eef632ef24dfc15a165
SSDEEP

12288:wMrHy90cZo8wMkIK5vUBkYMH/v5+up8vhe8OPKQa6CDD4KQ2/XVu08zEQw5AI9cM:nynxb1K58qKE8vjPQa6I7fKA9cFu3

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral16/memory/4764-14-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral16/memory/4764-21-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral16/memory/4764-19-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral16/memory/4764-18-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2AH552Br.exe	family_redline
behavioral16/memory/3016-22-0x0000000000960000-0x000000000099E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

si8bJ8cu.exe1eu89hi8.exe2AH552Br.exe

pid process

4224 si8bJ8cu.exe
5036 1eu89hi8.exe
3016 2AH552Br.exe

pid	process
4224	si8bJ8cu.exe
5036	1eu89hi8.exe
3016	2AH552Br.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838.exesi8bJ8cu.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	si8bJ8cu.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1eu89hi8.exe

description pid process target process

PID 5036 set thread context of 4764 5036 1eu89hi8.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2536 4764 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 5036 set thread context of 4764	5036	1eu89hi8.exe	AppLaunch.exe

pid	pid_target	process	target process
2536	4764	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838.exesi8bJ8cu.exe1eu89hi8.exe

description	pid	process	target process
PID 3656 wrote to memory of 4224	3656	b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838.exe	si8bJ8cu.exe
PID 3656 wrote to memory of 4224	3656	b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838.exe	si8bJ8cu.exe
PID 3656 wrote to memory of 4224	3656	b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838.exe	si8bJ8cu.exe
PID 4224 wrote to memory of 5036	4224	si8bJ8cu.exe	1eu89hi8.exe
PID 4224 wrote to memory of 5036	4224	si8bJ8cu.exe	1eu89hi8.exe
PID 4224 wrote to memory of 5036	4224	si8bJ8cu.exe	1eu89hi8.exe
PID 5036 wrote to memory of 4764	5036	1eu89hi8.exe	AppLaunch.exe
PID 5036 wrote to memory of 4764	5036	1eu89hi8.exe	AppLaunch.exe
PID 5036 wrote to memory of 4764	5036	1eu89hi8.exe	AppLaunch.exe
PID 5036 wrote to memory of 4764	5036	1eu89hi8.exe	AppLaunch.exe
PID 5036 wrote to memory of 4764	5036	1eu89hi8.exe	AppLaunch.exe
PID 5036 wrote to memory of 4764	5036	1eu89hi8.exe	AppLaunch.exe
PID 5036 wrote to memory of 4764	5036	1eu89hi8.exe	AppLaunch.exe
PID 5036 wrote to memory of 4764	5036	1eu89hi8.exe	AppLaunch.exe
PID 5036 wrote to memory of 4764	5036	1eu89hi8.exe	AppLaunch.exe
PID 5036 wrote to memory of 4764	5036	1eu89hi8.exe	AppLaunch.exe
PID 4224 wrote to memory of 3016	4224	si8bJ8cu.exe	2AH552Br.exe
PID 4224 wrote to memory of 3016	4224	si8bJ8cu.exe	2AH552Br.exe
PID 4224 wrote to memory of 3016	4224	si8bJ8cu.exe	2AH552Br.exe

C:\Users\Admin\AppData\Local\Temp\b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838.exe
"C:\Users\Admin\AppData\Local\Temp\b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si8bJ8cu.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si8bJ8cu.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1eu89hi8.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1eu89hi8.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4764
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 204
        5⤵
        Program crash
        
        PID:2536
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2AH552Br.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2AH552Br.exe
    3⤵
    - Executes dropped EXE
    PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4764 -ip 4764
1⤵
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3852,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si8bJ8cu.exe

Filesize
565KB

MD5
9eaafdd8378fc1e41b906d6077d185af

SHA1
96c9a91d197a0033ef1b08762a746c6e4f2dae06

SHA256
6dd4203591684976abf6d3831096161b568c828345f8f626de89251a427acad5

SHA512
ebfe8f4e205af1e17250e45b5d63d65a15cb485dda0a969e9d0b5db7f867fa5a9c849d53f2fd17c368914b7cc1bb93d1fdb1150a80405844d43b5c6c8535f2d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1eu89hi8.exe

Filesize
1.1MB

MD5
341aca572e3666ad97996a810fbb9fc6

SHA1
3d50dc6c6bbdbacdd67278950839272e79b3f6c8

SHA256
163ccc10af0dba868e991058a5f50fdefc1de610cd4976e88ad2c81bf9781c61

SHA512
0bfb2795af4e8c8a130946d20aba053aa13646f03d6a8263dd2438f637642f18a8910fcb7a2bf51d4aed7cd7c3b1884762f892f556d9d0b1160b366bf4de5790

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2AH552Br.exe

Filesize
221KB

MD5
de9d36440accfcd7ce7ed7a729accbc2

SHA1
a62a2aed578c72679a65707911609d00386be90b

SHA256
51c269f17c5439c6bcbb43efd0428d700fd9c1dcd8f4e9db1cd3d8fe190d410b

SHA512
3f72fd0cf03ba7ea3e0087589c7565efe065788d78542e057024ee7ff70d1c019bf8a15ccddf6ae127ec50e167a24a4763dad2abbbcbb19a4efd220291c355a4

Download Submit
memory/3016-27-0x0000000007A20000-0x0000000007B2A000-memory.dmp

Filesize
1.0MB

Download
memory/3016-22-0x0000000000960000-0x000000000099E000-memory.dmp

Filesize
248KB

Download
memory/3016-23-0x0000000007BC0000-0x0000000008164000-memory.dmp

Filesize
5.6MB

Download
memory/3016-24-0x00000000076F0000-0x0000000007782000-memory.dmp

Filesize
584KB

Download
memory/3016-25-0x0000000004C40000-0x0000000004C4A000-memory.dmp

Filesize
40KB

Download
memory/3016-26-0x0000000008790000-0x0000000008DA8000-memory.dmp

Filesize
6.1MB

Download
memory/3016-28-0x0000000007930000-0x0000000007942000-memory.dmp

Filesize
72KB

Download
memory/3016-29-0x0000000007990000-0x00000000079CC000-memory.dmp

Filesize
240KB

Download
memory/3016-30-0x00000000079D0000-0x0000000007A1C000-memory.dmp

Filesize
304KB

Download
memory/4764-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4764-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4764-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4764-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download